[Opendnssec-user] Information about SoftHSM v2 - signing operation

[Elizabeta]

Hi Rickard,

Thank you for the clarifications.  Thanks also to Roland for the previous information.
I will check in more details my trials and get back to you, if there are still some issues.

In addition, concerning the key generation are there any advises when to use the function C_CreateObject instead of C_GenerateKey ? I'm rising this question since, as given in the specification, we can use both of them for key generation. But  what would be the best choice?

Thanks in advance.

Best,
Elizabeta


Le 14 avr. 2015 à 20:58, Rickard Bellgrim <rickard at opendnssec.org> a écrit :

> Hi Elizabeta
> 
> C_Login() will log in the user on the token, thus changing the login state for all sessions on that token. The test script will login using hSessionRO, but hSessionRW will also move from the public state to the user state.
> 
> If you add C_Logout(hSessionRO) after the key generation and then try to create a signature, you should get rv==CKR_USER_NOT_LOGGED_IN.
> 
> It is not possible to use a private object (CKA_PRIVATE==CK_TRUE) without being logged in. You need the PIN to decrypt the key material.
> 
> // Rickard
> 
> On Tue, Apr 14, 2015 at 3:21 PM, Elizabeta <elizabeta.fourneret at gmail.com> wrote:
> Hi Roland,
> 
> I have a set of CPPUNIT tests for PKCS#11 that I'm using to discover SoftHSM, based on the SoftHSM v2 test configuration.
> For key generation, I'm using the generateKey function (see SignVerifyTests.cpp in the SoftHSM v2 test folder).
> 
> However, the outcome of my tests, even if the CKA_PRIVATE attribute is CK_TRUE, is that I'm managing to sign without authentication.
> 
> Cheers,
> Elizabeta
> 
> Le 14 avr. 2015 à 13:54, Roland van Rijswijk - Deij <Roland.vanRijswijk at surfnet.nl> a écrit :
> 
> > Hi Elizabeta,
> >
> > Elizabeta wrote:
> >> I'm new to opendnsec. I've tried to use SoftHSM v2 and I was able to sign a message without logging in.
> >> Is that fine for SoftHSM ? since in the PKCS#11 specification it is written that some tokens may not require any type of authentication to make the usage of its cryptographic functions.
> >
> > To answer your question we'll need a little bit more context. When you
> > say sign, do you mean that you have (created) a program that used
> > SoftHSM v2 as a PKCS #11 library? And if so, how did you create the keys
> > that you were using to sign? If the private key was created with the
> > CKA_PRIVATE attribute set to CK_FALSE, then you can create signatures
> > without logging in on the token.
> >
> > Cheers,
> >
> > Roland
> >
> > --
> > -- Roland M. van Rijswijk - Deij
> > -- SURFnet bv
> > -- w: http://www.surf.nl/en/about-surf/subsidiaries/surfnet
> > -- e: roland.vanrijswijk at surfnet.nl
> 
> _______________________________________________
> Opendnssec-user mailing list
> Opendnssec-user at lists.opendnssec.org
> https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20150415/a637fcf8/attachment.htm>